@@ -12,6 +12,35 @@ private import codeql.ruby.ApiGraphs
1212private import codeql.ruby.security.OpenSSL
1313private import codeql.ruby.dataflow.FlowSummary
1414
15+ private module RenderCallUtils {
16+ private Expr getTemplatePathArgument ( MethodCall renderCall ) {
17+ // TODO: support other ways of specifying paths (e.g. `file`)
18+ result =
19+ [ renderCall .getKeywordArgument ( [ "partial" , "template" , "action" ] ) , renderCall .getArgument ( 0 ) ]
20+ }
21+
22+ private string getTemplatePathValue ( MethodCall renderCall ) {
23+ result = getTemplatePathArgument ( renderCall ) .getConstantValue ( ) .getStringlikeValue ( )
24+ }
25+
26+ // everything up to and including the final slash, but ignoring any leading slash
27+ private string getSubPath ( MethodCall renderCall ) {
28+ result = getTemplatePathValue ( renderCall ) .regexpCapture ( "^/?(.*/)?(?:[^/]*?)$" , 1 )
29+ }
30+
31+ // everything after the final slash, or the whole string if there is no slash
32+ private string getBaseName ( MethodCall renderCall ) {
33+ result = getTemplatePathValue ( renderCall ) .regexpCapture ( "^/?(?:.*/)?([^/]*?)$" , 1 )
34+ }
35+
36+ ErbFile getTemplateFile ( MethodCall renderCall ) {
37+ result .getTemplateName ( ) = getBaseName ( renderCall ) and
38+ result .getRelativePath ( ) .matches ( "%app/views/" + getSubPath ( renderCall ) + "%" )
39+ }
40+
41+ HashLiteral getLocals ( MethodCall renderCall ) { result = renderCall .getKeywordArgument ( "locals" ) }
42+ }
43+
1544/**
1645 * Provides classes for working with Rails.
1746 */
@@ -39,37 +68,15 @@ module Rails {
3968 * rendered content.
4069 */
4170 class RenderCall extends MethodCall instanceof RenderCallImpl {
42- private Expr getTemplatePathArgument ( ) {
43- // TODO: support other ways of specifying paths (e.g. `file`)
44- result = [ this .getKeywordArgument ( [ "partial" , "template" , "action" ] ) , this .getArgument ( 0 ) ]
45- }
46-
47- private string getTemplatePathValue ( ) {
48- result = this .getTemplatePathArgument ( ) .getConstantValue ( ) .getStringlikeValue ( )
49- }
50-
51- // everything up to and including the final slash, but ignoring any leading slash
52- private string getSubPath ( ) {
53- result = this .getTemplatePathValue ( ) .regexpCapture ( "^/?(.*/)?(?:[^/]*?)$" , 1 )
54- }
55-
56- // everything after the final slash, or the whole string if there is no slash
57- private string getBaseName ( ) {
58- result = this .getTemplatePathValue ( ) .regexpCapture ( "^/?(?:.*/)?([^/]*?)$" , 1 )
59- }
60-
6171 /**
6272 * Gets the template file to be rendered by this call, if any.
6373 */
64- ErbFile getTemplateFile ( ) {
65- result .getTemplateName ( ) = this .getBaseName ( ) and
66- result .getRelativePath ( ) .matches ( "%app/views/" + this .getSubPath ( ) + "%" )
67- }
74+ ErbFile getTemplateFile ( ) { result = RenderCallUtils:: getTemplateFile ( this ) }
6875
6976 /**
7077 * Get the local variables passed as context to the renderer
7178 */
72- HashLiteral getLocals ( ) { result = this . getKeywordArgument ( "locals" ) }
79+ HashLiteral getLocals ( ) { result = RenderCallUtils :: getLocals ( this ) }
7380 // TODO: implicit renders in controller actions
7481 }
7582
0 commit comments